Getting Refused to connect to X because it violates the following Content Security Policy directive

Here's a working code example. Working in all browsers and ios-App:

var xhr = new XMLHttpRequest();
            var _this = this.host;
            xhr.open("POST", "https://httpbin.org/post", true);
            xhr.setRequestHeader("Content-Type", "application/json");
            xhr.send(
              JSON.stringify({
                value: "Hello world",
              })
            );
            xhr.onload = function () {
              console.log(this.responseText);
              _this.displayWarningIcon(
                "Post-Request-Result",
                this.responseText
              );
            };

capabilities.json

...    
"privileges": [{
            "name": "WebAccess",
            "essential": true,
            "parameters": [
                "https://httpbin.org/post", ...
	    ]
        },
...

 HTH